Connecting an AI assistant to your cloud storage is now a two-click operation. ChatGPT, Claude, Gemini and Copilot all offer it. The question that follows is simple: what can it actually see?
The answer is more specific, and more manageable, than the headlines suggest. It is also different from the question of whether your provider trains AI on your files. That page is about the company that stores your files. This one is about the assistant you deliberately let in, and the three things that genuinely change once you do.
The short version
Connecting an assistant does three things, and only the first one is obvious.
- The assistant can read what your account can read. Every major connector mirrors your existing permissions. It does not get more access than you have; it gets all the access you have, unless you narrow it.
- What it reads leaves your storage provider. The file contents travel to the company running the assistant and sit in your conversation history there. That is not a leak — it is the entire mechanism — but it is a second copy in a second company.
- A document can carry instructions. This is the genuinely new risk, and the one that has produced real, patched, named vulnerabilities. A file you never wrote, in a folder the assistant can read, can contain text aimed at the assistant rather than at you.
None of those require a doomsday reading of AI to matter. They are ordinary access-control facts.
What each assistant says it does
| Assistant | What the connector reads | Trained on connector data? | Where the file contents end up |
|---|---|---|---|
| ChatGPT (Google Drive, Dropbox, SharePoint, Box) | What the connected account can access. Some workspace setups index content in advance. | No, for data taken directly from connected Google apps — with named exceptions (feedback, copy-paste, content in a response). | OpenAI, in your conversation. Memory may retain derived details separately. |
| Claude (Gmail, Drive, Calendar, MCP) | What the connected account can access; text only, retrieved per request. | No, not on Gmail/Drive/Calendar connector data. Copy-pasted content on consumer plans is a stated exception. | Anthropic servers, stored with the chat. Deleting the chat deletes it. |
| Google Gemini in Workspace | Workspace content your account can access. | Google says Workspace content is not used to train its models without permission; consumer Gemini activity is different. | Google — which already held the files. |
| Microsoft 365 Copilot | Tenant content via Microsoft Graph that your account can access. | Microsoft says Graph-accessed tenant data is not used to train its foundation models. | Microsoft — which already held the files. |
| ShieldFive MCP | Only the folders you pick, for the window you pick. Decrypted on your own computer. | Not by ShieldFive: we hold only ciphertext and never the keys. The assistant's provider sees what it reads. | Your machine, then the assistant's provider for whatever it reads. |
Two of those rows are worth pausing on. With Gemini in Workspace and Copilot in Microsoft 365, the assistant is run by the company that already holds your files and already holds your keys. Connecting it adds convenience, not a new reader. With ChatGPT or Claude reading your Google Drive, you are introducing a second company to files the first one could already see.
The receipts
ChatGPT
OpenAI's documentation is explicit that connected apps mirror existing permissions: "ChatGPT can access only content available to the account you connect, after you authorize access," and app permissions "do not grant an app new access" — changing them "only changes when ChatGPT asks before using the access the app already has" (Connected apps in ChatGPT, Google app data controls FAQ).
On training, the Google-specific FAQ states: "We do not train our generalized models on data directly from connected Google apps or derivations of that data," with three listed exceptions — a conversation submitted as feedback, data you copy, paste or upload yourself, and data included in ChatGPT's response. It adds that this holds "even if" the "Improve the model for everyone" setting is on.
Two details deserve more attention than they get:
- Memory is a separate channel. If Memory is enabled, information from connected apps "may help personalize ChatGPT." And disconnecting is not deletion: "disconnecting an app does not automatically delete existing chats or saved memories."
- Indexing is not always on demand. An ordinary connection "does not automatically create a personal synced index," but administrator-managed setups can index Drive content in advance for faster answers.
Claude
Anthropic's Google Workspace connector page (updated 2026-08-18) states that Claude "can only access the Gmail, Calendar, and Drive data for the Google account you've connected," accesses it "only when you explicitly ask a question or request an action requiring this information," and "mirrors your existing permissions — you cannot access information you don't already have access to." Retrieved data "is retained with its associated chat, so you can delete any retrieved data by deleting the chat" (Use Google Workspace connectors).
On training: "We do not train our models on your Gmail, Drive, or Calendar connector data." The stated exception is consumer plans where you have opted into training and you copy and paste connector content into the conversation yourself.
Note also what the connector can do, not just read: send, reply to and forward email; share, move and trash Drive files. By default each of those asks for approval first, but on Team and Enterprise plans an owner can let them run without asking.
Gemini and Copilot
These are the same companies covered in our AI training comparison, and the analysis there applies unchanged: both hold your keys, both say organizational content is not used to train their foundation models, and in both cases the protection is a policy rather than the architecture. Turning the assistant on does not hand your files to a party that could not already read them.
The risk that is actually new: instructions hidden in documents
Everything above assumes the assistant does what you asked. The failure mode specific to connectors is indirect prompt injection: text placed inside a document, an email or a file name, written for the assistant rather than for you, which the assistant reads as an instruction while processing your perfectly ordinary request.
This is not theoretical. Two named, documented cases:
- EchoLeak (CVE-2025-32711, CVSS 9.3), disclosed by Aim Security in June 2025: a single crafted email could cause Microsoft 365 Copilot to pull internal content and exfiltrate it to an attacker's server, with no click from the victim. The write-up describes it as the first real-world zero-click prompt-injection exploit in a production LLM system (arXiv analysis). Microsoft patched it server-side and said it had not been exploited in the wild.
- AgentFlayer, presented at Black Hat in August 2025 by researchers at Zenity: a "poisoned" document placed in a victim's Google Drive carried hidden instructions — white text, invisible to a reader — that caused ChatGPT's connector to exfiltrate secrets by encoding them into an image URL (Zenity Labs). The researchers noted the technique is not specific to Drive.
Both were patched. The pattern is the point: a connector turns every file the assistant can reach into potential input, including files other people put there. Shared folders, email attachments and anything auto-saved from the internet are the exposure, and traditional defences do not apply — the payload is natural language, so there is nothing for antivirus or a file scanner to match.
The practical mitigation is unglamorous and effective: narrow the scope. An assistant pointed at one project folder cannot be injected by a document in a folder it cannot see.
What to actually do
A checklist that takes about ten minutes and does more than any amount of reading about AI risk:
- Scope the connection to folders, not to everything. Most breaches of expectation here are not attacks; they are an assistant reading something you forgot was in the same account.
- Decide about Memory separately. Connector data and Memory are different settings with different lifetimes. Disconnecting one does not clear the other.
- Check whether actions are enabled, not just reading. "Read my Drive" and "trash files in my Drive" are different grants. On team plans, check whether approval prompts have been switched off for everyone.
- Treat shared folders as untrusted input. If other people can drop files where your assistant reads, that is the injection surface.
- Delete the conversation when the task is done. For Claude, that is stated to remove the retrieved data. For ChatGPT, remember that disconnecting alone does not.
- Keep the files that should never be assistant-readable somewhere the assistant is not connected.
That last point is the only one that is architectural rather than procedural, and it is the reason this page exists on a storage provider's site.
Where ShieldFive fits
ShieldFive encrypts files on your device before upload, so we hold ciphertext. That has a specific consequence for this topic: we cannot connect an assistant to your files on our side, because we only hold ciphertext and never the keys. There is no server-side index to point a model at.
What we ship instead is an MCP server that runs on your own computer. It decrypts there, and it is deliberately narrow:
- You choose whole-vault or specific folders, up to 50, and whether the Media folder is included.
- You choose read-only or read-and-organize (rename, move, move to the Bin — at most 50 items per request, all undoable).
- You choose an expiry, from one hour to 90 days.
- Every action is listed in an activity log you can read, and nothing is ever deleted outright: trashed items go to a Bin folder for that connection.
- Revoking cuts access on the assistant's next request.
And the part we put in the product UI rather than in the marketing: the assistant's provider sees whatever it reads, exactly as with any other connector, and revoking cannot take back what has already been read. That is not a ShieldFive limitation; it is what connecting an assistant means, anywhere. What differs is how small a slice you have to expose, for how long, and whether the storage company is a third party with a copy.
Read the security explanation before deciding whether this trust model fits your needs, and scope a first connection to a single folder rather than the whole vault.
Frequently asked questions
Can ChatGPT read my Google Drive?
Only if you connect it, and then only the files the Google account you connected can already access. OpenAI states that app permissions do not grant new access and that ChatGPT can access "only content available to the account you connect." What it reads is sent to OpenAI as part of your conversation.
Does connecting an AI assistant mean my files are used for training?
Not directly, according to both OpenAI and Anthropic. OpenAI says it does not train its generalized models on data from connected Google apps, with exceptions for feedback submissions, data you paste in yourself, and content appearing in a response. Anthropic says it does not train on Gmail, Drive or Calendar connector data, with a copy-paste exception on consumer plans where training is enabled. Both are policies, not architectural limits.
Can an AI assistant delete my files?
Some connectors support it. Claude's Google Drive connector can share, move and trash files, and asks for approval by default — but on Team and Enterprise plans an owner can allow those actions to run without asking each time. Check what actions are enabled, not only what can be read.
What is indirect prompt injection?
Instructions hidden inside a document, email or file name that are aimed at the AI assistant rather than at you. When the assistant reads that file as part of an ordinary request, it may follow them. EchoLeak (Microsoft 365 Copilot, June 2025) and AgentFlayer (ChatGPT connectors, August 2025) are documented, patched examples in which this was used to exfiltrate data with no click from the victim.
How do I stop an AI assistant from reading a specific folder?
Scope the connection when you create it, rather than revoking afterwards. Most connectors grant access at the account level, so the reliable way to keep a folder out of reach is to keep it in an account or a service the assistant is not connected to.
Does ShieldFive let AI assistants read my files?
Only the folders you explicitly choose, for a time window you choose, through an MCP server that runs on your computer and decrypts there. ShieldFive only ever handles ciphertext. The assistant's provider does see whatever the assistant reads, and revoking access does not retract what it has already read.
This page reflects each vendor's public documentation as of 2026-09-21 and will be updated as the terms change. Connector features and data-use policies move quickly; before relying on any line here, check the vendor's current documentation via the links.